Privacy Policy
Last updated: Mar 19, 2026
This Privacy Policy explains how Basecomp Ltd (company number 12656598) ("Basecomp", "we", "us", or "our") collects, uses, and protects personal data in connection with the Basecomp platform.
We are committed to protecting personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. We are registered with the Information Commissioner's Office (ICO) under registration number C1893562.
1. Controller and Processor Roles
Basecomp plays two distinct roles in relation to personal data, and this distinction matters:
- Data Controller — for personal data we collect about Merchants (the businesses that use our platform to run competitions). This includes account details, billing information, and platform usage data. We determine the purposes and means of processing this data.
- Data Processor — for personal data collected about customers who purchase tickets on Merchant storefronts. In this role, the Merchant is the Data Controller and Basecomp processes customer data on their behalf, strictly under our Data Processing Agreement.
If you are a customer who entered a competition on a Merchant's storefront and want to exercise your data rights, your primary point of contact is the Merchant. For requests that require Basecomp's involvement as processor, please contact us and we will coordinate with the relevant Merchant.
2. Data We Collect
Merchant account data
- Name and email address
- Business name, contact details, and registered address
- Billing information (card details are handled by Stripe — we store only a payment reference)
- Store configuration, preferences, and settings
- Support communications and correspondence
Customer data (processed on behalf of Merchants)
- Name, email address, and contact details
- Order history and ticket entries
- Delivery address (where prize fulfilment requires it)
- IP address and device/browser information
Technical and usage data
- IP addresses and approximate location data
- Browser type, device type, and operating system
- Platform usage patterns and feature interactions
- Log data, error reports, and performance metrics
3. How We Use Personal Data
We use Merchant account data to:
- Provide, operate, and improve the Basecomp platform
- Process subscription billing and manage your account
- Communicate about platform updates, security alerts, and support matters
- Analyse usage to improve our products and develop new features
- Comply with legal and regulatory obligations
- Detect and prevent fraud, abuse, and security threats
Our legal bases for processing Merchant data are: performance of a contract (providing the platform), legitimate interests (security, product improvement, fraud prevention), compliance with legal obligations, and, where required, consent.
4. Subprocessors
We do not sell personal data. We share data only with trusted subprocessors whose services are necessary to deliver the platform:
| Subprocessor | Purpose | Location |
|---|---|---|
| Stripe | Payment processing and billing | US (UK adequacy / SCCs) |
| Amazon Web Services (AWS) | Cloud infrastructure and file storage | EU (Ireland) |
| Cloudflare | CDN, DDoS protection, and DNS | US (SCCs applied) |
| OpenAI | AI-powered content translation | US (SCCs applied) |
| Meilisearch | Full-text search | EU |
| Crisp | Customer support chat | EU (France) |
All subprocessors are subject to appropriate data protection agreements and are assessed for their security practices.
5. International Data Transfers
Some subprocessors process data outside the UK. Where this occurs, we rely on UK adequacy decisions or Standard Contractual Clauses (SCCs) as approved by the ICO to ensure that personal data receives an equivalent level of protection.
6. Data Retention
We retain Merchant account data for the duration of your account and for up to 7 years afterwards to satisfy UK financial record-keeping and legal obligations. Customer data processed on behalf of Merchants is retained in accordance with each Merchant's own retention policy — Merchants are responsible for managing their customers' retention periods.
You may request deletion of your account and associated data at any time. We will action deletion requests within 30 days, subject to any legal obligations that require us to retain certain records.
7. Your Rights Under UK GDPR
Where Basecomp is the Data Controller for your data (i.e., you are a Merchant account holder), you have the following rights:
- Right of access — request a copy of the personal data we hold about you
- Right to rectification — request correction of inaccurate or incomplete data
- Right to erasure — request deletion of your data in certain circumstances
- Right to restriction — request that we temporarily limit processing of your data
- Right to data portability — receive your data in a structured, machine-readable format
- Right to object — object to processing based on legitimate interests
We do not use solely automated decision-making that has legal or similarly significant effects on you.
To exercise any of these rights, contact us at [email protected]. We will respond within one calendar month. You also have the right to lodge a complaint with the Information Commissioner's Office at ico.org.uk.
8. Security
We implement industry-standard technical and organisational measures to protect personal data, including TLS encryption in transit, encryption at rest, strict access controls, and regular security reviews. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify you and the ICO as required under UK GDPR.
9. Cookies
We use cookies and similar technologies on the Basecomp platform. For full details on what we set and how to control them, see our Cookie Policy.
10. Changes to This Policy
We may update this Privacy Policy periodically. We will notify you of material changes by email or prominent notice on the platform at least 30 days before they take effect.
11. Contact
For privacy enquiries or to exercise your data rights, contact us at [email protected].
Basecomp Ltd · Company No: 16546483 · 128 City Road, London, EC1V 2NX · Registered in England and Wales